DecoyPulse Honeypot Triggered
Medium
False Positive
ALR-00006 · 2026-07-09T14:08:49Z
Description
DecoyPulse honeypot on SW-CORE-01 triggered by internal IP. Credentials for decoy admin account used. Zero false positive — investigating.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
14:08:49
Event ingested by SOC365 Engine
14:08:54
EmilyAI triage started — correlation enrichment
14:08:56
EmilyAI confidence: 86% — escalated to human analyst
14:09:32
Alert assigned to analyst: Anika Patel
14:11:43
Investigation started — querying SIEM and threat intelligence
14:13:15
Containment action taken — endpoint isolated
14:28:05
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00073 | 16m ago | Shadow IT Discovery | Low | Escalated | SW-CORE-01 |
| ALR-00335 | 3h ago | DecoyPulse Honeypot Triggered | Informational | Open | FW-EDGE-01 |
| ALR-00238 | 11h ago | Suspicious PowerShell Execution | Medium | Escalated | SW-CORE-01 |
| ALR-00477 | 17h ago | Unauthorised USB Device | High | Escalated | SW-CORE-01 |
| ALR-00441 | 19h ago | Kerberoasting Attempt | Medium | False Positive | SW-CORE-01 |